Also, just as an FYI, i do network security in a completely different sector, but the attacks are usually the same. The "sneak forwarding" is a common targeted attack.
I cross-checked my mailbox setup and no forwarding is configured here. For now I fully blame OVH for this issue.